Re: Security audit of Oracle databases

Rachel,

You need not have revealed this secret to all and sundry. Who knows, there might
even be a few SOX auditors lurking on this list -- auditors who will know demand
that both the "root" and the "oracle" passwords be split amongst two people each --
requiring 4 SA/DBA persons !

There are auditors who say that the DBA should not login to the server as "oracle" but should login as "hemant" and then "su" to oracle {after which he can do as he d* well pleases}. There are auditors who say that the "root" account should not be used but that it is OK to have named accounts with administrative privileges , not knowing what "uid 0" means.

Hemant

At 11:15 PM Monday, you wrote:

>I had a sysadmin at a site once tell me that since I was the only DBA,
>for security reasons, I HAD to give him the password to the oracle
>account... in an email. I replied "you don't need it". He said "oh
>wait, you're right, that's not secure -- leave it to me in a
>voicemail"
>
>I replied again "you don't need it". And later, when there wasn't a
>crowd around, gently explained to him that as root, he had access to
>ANY account on the system... and so did not need the password.

Hemant K Chitale
http://web.singnet.com.sg/~hkchital

--
http://www.freelists.org/webpage/oracle-l